See, I specifically remember Debian maintaners arguing that they "don't need HTTPS" on the default repos because it's signed anyway. Now it has backfired on them. (Of course, the better solution is not blindly trusting every GPG key for every source. But if all of the users' sources had HTTPS, that would have mitigated the issue.)